Page 22 - 11Cyber

words (6). For example, Google for 'hello kitty'
(Continued from page 21)
Step 5 – The server checks this hash against the
one stored for the user in the database.
Step 6 – If the two hashes match exactly, the user
is granted access. The Dictionary for Uncracking
the Egg
So, if no one can Unscramble the password, how
are the criminals actually getting into an account
after getting that Data Breach file from the Dark
Web? The answer is they probably don't need to
Unscramble it. They have a Dictionary. Or several. I
am referring to what is properly called a Hash
Table Dictionary (also known as a Rainbow Table.
(4) I will simply call it - a dictionary.
What is a dictionary, and how
does it help? Remember in 'The
Hash' that the data for account 1
and account 4 had an identical
Password and Hash? THAT is
the weakness of a hash code. Anyone can run the
hash function on as many words as they want and
save the hash values in a database (this becomes
their Dictionary). SO, they can save the hash for all
the passwords like '12345' and 'admin' and any oth- But wait…. There's more. We have only done that for
er word in a list of well-known, commonly re-used,
and very bad passwords.
For example, the MD5 hash for helloworld is
fc5e038d38a57032085441e7fe7010b0 And, that
PW is now in their' dictionary.' When they look for
'fc5e….' in the stolen database, they find it, and it
belongs to both user 1 and user 4. Both must have
a password of helloworld. Almost zero seconds to
look through the data and find all the fools who
have used helloworld as their password. And they
are not even breaking a sweat yet.
So, if you are a bad guy, what do you do? You
would create huge lists using all the known pass-
words and their hash. Those lists of words and
phrases contain things that have been used most
often that will give them the biggest bang for their
buck. And, with the hash for each of those pass-
words, all you need to do is look for them in the sto- can and should be fixed from two ends of the system.
len database. Just one problem, and it is a big prob- If the hash is bad, we need to add Salt. But who
lem; there are a lot of words you must hash. That
creates huge files. (You can check any password,
plus variations, in a list of 14,344,391 known pass-
Cyber Awareness Bulletin
site:https://md5hashonline.com/most-common-
passwords/ On page 310 it is word number 30,972 )
Bigger is Better
And the longer the password lengths get, the huger
(more bigger?) that file grows. So, for example, for
passwords with just 9 lower case letters (abcdefghi),
the number of passwords that could be formed is
5,646,683,826,134. But, of course, all those are not
words, and as the number of characters (or numbers
or symbols) increases, so does the size of the data-
base they have to hash to complete their dictionary.
So even if they had a database with all the possible
combinations of 9 lower case and 3 uppercase letters,
they would have almost 4 x 1020 passwords. And with
no symbols or numbers, it is not even close to being
complete. And they would need to buy a lot of big
drives and have lots of supercomputers working
around the clock.
So, what do they do? They have reasonably sized (but
huge) Hash Table Dictionaries, which they can afford
to purchase, and have enough disk space to store, to
get maybe just those top 5 (or 14 or 600) million com-
mon, repeated, very awful, known passwords.
the MD5 function. They still need the time and disk
space for the SHA-1, SHA-256, NTLM, and LANMAN.
And what about words written in other languages?
(Holamundo is helloworld in Spanish!) More possibili-
ties. Without those, all of the data that was breached is
of much less use to them. Unless they want to test
words one hash, one at a time, that is called Brute
Force. For the next 10 thousand years. (See footnote
(7) about Hashcat). It is possible, but…..?)
To Improve the Hash, Add Salt
So, you see the problem here.
Einstein told us. Do the same
thing, get the same thing. It IS re-
peatable. Those repeated pass-
words all had the same repeated
hash. How can that be fixed? It is
neither impossible nor difficult. It
should add the salt, You, or the Cook? It turns out the
Cooks ought to season the hash, but in case they did
(Continued on page 23)
22 October 2021